X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/4398ef03604ddbc1fd3942246ae0d67d83d33fae..8e43dcf899a3322e66c709b149ce557f5255bf18:/sdk/python/tests/nginx.conf diff --git a/sdk/python/tests/nginx.conf b/sdk/python/tests/nginx.conf index 1ef3b00c66..7fe55259f6 100644 --- a/sdk/python/tests/nginx.conf +++ b/sdk/python/tests/nginx.conf @@ -3,12 +3,11 @@ # SPDX-License-Identifier: Apache-2.0 daemon off; -error_log "{{ERRORLOG}}" info; # Yes, must be specified here _and_ cmdline events { } http { log_format customlog - '[$time_local] $server_name $status $body_bytes_sent $request_time $request_method "$scheme://$http_host$request_uri" $remote_addr:$remote_port ' + '[$time_local] "$http_x_request_id" $server_name $status $body_bytes_sent $request_time $request_method "$scheme://$http_host$request_uri" $remote_addr:$remote_port ' '"$http_referer" "$http_user_agent"'; access_log "{{ACCESSLOG}}" customlog; client_body_temp_path "{{TMPDIR}}"; @@ -16,12 +15,31 @@ http { fastcgi_temp_path "{{TMPDIR}}"; uwsgi_temp_path "{{TMPDIR}}"; scgi_temp_path "{{TMPDIR}}"; + upstream controller { + server {{LISTENHOST}}:{{CONTROLLERPORT}}; + } + server { + listen {{LISTENHOST}}:{{CONTROLLERSSLPORT}} ssl; + server_name controller ~.*; + ssl_certificate "{{SSLCERT}}"; + ssl_certificate_key "{{SSLKEY}}"; + client_max_body_size 0; + location / { + proxy_pass http://controller; + proxy_set_header Host $http_host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto https; + proxy_redirect off; + proxy_request_buffering off; + proxy_max_temp_file_size 0; + } + } upstream arv-git-http { - server localhost:{{GITPORT}}; + server {{LISTENHOST}}:{{GITPORT}}; } server { - listen *:{{GITSSLPORT}} ssl default_server; - server_name arv-git-http; + listen {{LISTENHOST}}:{{GITSSLPORT}} ssl; + server_name arv-git-http git.*; ssl_certificate "{{SSLCERT}}"; ssl_certificate_key "{{SSLKEY}}"; location / { @@ -33,11 +51,11 @@ http { } } upstream keepproxy { - server localhost:{{KEEPPROXYPORT}}; + server {{LISTENHOST}}:{{KEEPPROXYPORT}}; } server { - listen *:{{KEEPPROXYSSLPORT}} ssl default_server; - server_name keepproxy; + listen {{LISTENHOST}}:{{KEEPPROXYSSLPORT}} ssl; + server_name keepproxy keep.*; ssl_certificate "{{SSLCERT}}"; ssl_certificate_key "{{SSLKEY}}"; location / { @@ -47,16 +65,17 @@ http { proxy_set_header X-Forwarded-Proto https; proxy_redirect off; + client_max_body_size 67108864; proxy_http_version 1.1; proxy_request_buffering off; } } upstream keep-web { - server localhost:{{KEEPWEBPORT}}; + server {{LISTENHOST}}:{{KEEPWEBPORT}}; } server { - listen *:{{KEEPWEBSSLPORT}} ssl default_server; - server_name keep-web; + listen {{LISTENHOST}}:{{KEEPWEBSSLPORT}} ssl; + server_name keep-web collections.* ~\.collections\.; ssl_certificate "{{SSLCERT}}"; ssl_certificate_key "{{SSLKEY}}"; location / { @@ -71,45 +90,48 @@ http { proxy_request_buffering off; } } + upstream health { + server {{LISTENHOST}}:{{HEALTHPORT}}; + } server { - listen *:{{KEEPWEBDLSSLPORT}} ssl default_server; - server_name keep-web-dl ~.*; + listen {{LISTENHOST}}:{{HEALTHSSLPORT}} ssl; + server_name health health.*; + ssl_certificate "{{SSLCERT}}"; + ssl_certificate_key "{{SSLKEY}}"; + location / { + proxy_pass http://health; + proxy_set_header Host $http_host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto https; + proxy_redirect off; + + proxy_http_version 1.1; + proxy_request_buffering off; + } + } + server { + listen {{LISTENHOST}}:{{KEEPWEBDLSSLPORT}} ssl; + server_name keep-web-dl download.* ~.*; ssl_certificate "{{SSLCERT}}"; ssl_certificate_key "{{SSLKEY}}"; location / { proxy_pass http://keep-web; + proxy_set_header Host $http_host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto https; + proxy_redirect off; client_max_body_size 0; proxy_http_version 1.1; proxy_request_buffering off; - - # Unlike other proxy sections, here we need to override the - # requested Host header and use proxy_redirect because of the - # way the test suite orchestrates services. Keep-web's "download - # only" behavior relies on the Host header matching a configured - # value, but when run_test_servers.py writes keep-web's command - # line, the keep-web-dl TLS port (which clients will connect to - # and include in their Host header) has not yet been assigned. - # - # In production, "proxy_set_header Host $http_host; - # proxy_redirect off;" works: keep-web's redirect URLs will - # match the request URL received by Nginx. - # - # Here, keep-web will issue redirects to https://download/ and - # Nginx will rewrite them. - # - proxy_set_header Host download; - proxy_redirect https://download/ https://$host:{{KEEPWEBDLSSLPORT}}/; } } upstream ws { - server localhost:{{WSPORT}}; + server {{LISTENHOST}}:{{WSPORT}}; } server { - listen *:{{WSSPORT}} ssl default_server; - server_name websocket; + listen {{LISTENHOST}}:{{WSSSLPORT}} ssl; + server_name websocket ws.*; ssl_certificate "{{SSLCERT}}"; ssl_certificate_key "{{SSLKEY}}"; location / { @@ -122,16 +144,32 @@ http { proxy_redirect off; } } - upstream controller { - server localhost:{{CONTROLLERPORT}}; + upstream workbench1 { + server {{LISTENHOST}}:{{WORKBENCH1PORT}}; } server { - listen *:{{CONTROLLERSSLPORT}} ssl default_server; - server_name controller; + listen {{LISTENHOST}}:{{WORKBENCH1SSLPORT}} ssl; + server_name workbench1 workbench1.* workbench.*; ssl_certificate "{{SSLCERT}}"; ssl_certificate_key "{{SSLKEY}}"; location / { - proxy_pass http://controller; + proxy_pass http://workbench1; + proxy_set_header Host $http_host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto https; + proxy_redirect off; + } + } + upstream workbench2 { + server {{LISTENHOST}}:{{WORKBENCH2PORT}}; + } + server { + listen {{LISTENHOST}}:{{WORKBENCH2SSLPORT}} ssl; + server_name workbench2 workbench2.*; + ssl_certificate "{{SSLCERT}}"; + ssl_certificate_key "{{SSLKEY}}"; + location / { + proxy_pass http://workbench2; proxy_set_header Host $http_host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto https;